Fortinet black logo

Administration Guide

Triggers

Triggers

There are two types of automation triggers that can be configured in automation stitches: static and dynamic.

Static automation triggers are included in FortiOS by default. They require only a name, description, and one setting. Static automation triggers can be edited, but they cannot be deleted.

Dynamic automation triggers require multiple settings to be configured. Dynamic automation triggers can be created by clicking the Create New button on the Trigger tab, or clicking Create within the Create Automation Stitch page.

The following table outlines the available static triggers.

Trigger

Description

Anomaly Logs

An anomalous event has occurred. See Event log category triggers for an example.

Any Security Rating Notification

A summary is available for a recently run Security Rating report. The default report type is Any. Other available options include:

  • Security Posture
  • Fabric Coverage
  • Optimization

AV & IPS DB Update

The antivirus and IPS database is updating.

Compromised Host

An indicator of compromise (IoC) is detected on a host endpoint.

Additional actions are available only for Compromised Host triggers:

  • Access Layer Quarantine
  • FortiClient Quarantine
  • VMware NSX Security Tag
  • IP Ban

Configuration Change

A FortiGate configuration change has occurred.

Conserve Mode

A FortiGate entered conserve mode due to low memory. See Execute a CLI script based on memory and CPU thresholds for an example.

FortiGate Cloud-Based IOC

IOC detection from the FortiGate Cloud IOC service.

This option requires an IOC license, a web filter license, and FortiCloud logging must be enabled.

HA Failover

An HA failover is occurring.

High CPU

A FortiGate has high CPU usage. See Execute a CLI script based on memory and CPU thresholds for an example.

IPS Logs

An IPS event has occurred.

License Expiry

A FortiGuard license is expiring. The default license type is Any. Other available options include:

The license type must be selected. Options include:

  • FortiCare Support
  • FortiGuard Web Filter
  • FortiGuard AntiSpam
  • FortiGuard AntiVirus
  • FortiGuard IPS
  • FortiGuard Management Service
  • FortiGate Cloud

Local Certificate Expiry

A local certificate is about to expire. See Certificate expiration trigger for an example.

Reboot

A FortiGate is rebooting.

SSH Logs

An SSH event has occurred.

Traffic Violation

A traffic policy has been violated.

Virus Logs

A virus event has occurred.

Web Filter Violation

A web filter policy has been violated.

The following table outlines the available dynamic triggers.

Category

Trigger

Description

Security Fabric

Fabric Connector Event

An event has occurred on a specific Fabric connector. See Fabric connector event trigger for details.

FortiAnalyzer Event Handler

The specified FortiAnalyzer event handler has occurred. See FortiAnalyzer event handler trigger for details.

FortiGate Cloud Event Handler

The specified FortiGate Cloud event handler has occurred.

This option requires a FortiGate Cloud log retention license.

Miscellaneous

FortiOS Event Log

The specified FortiOS log has occurred.

Multiple event log IDs can be selected, and log field filters can be applied. See FortiOS event log trigger for an example.

Incoming Webhook

An incoming webhook is triggered.

Schedule

A scheduled monthly, weekly, daily, hourly, or one-time trigger. Set to occur on a specific minute of an specific hour on a specific day. When using the one-time trigger, set to occur on specific date and time in the future. See Schedule trigger for an example.

Triggers

There are two types of automation triggers that can be configured in automation stitches: static and dynamic.

Static automation triggers are included in FortiOS by default. They require only a name, description, and one setting. Static automation triggers can be edited, but they cannot be deleted.

Dynamic automation triggers require multiple settings to be configured. Dynamic automation triggers can be created by clicking the Create New button on the Trigger tab, or clicking Create within the Create Automation Stitch page.

The following table outlines the available static triggers.

Trigger

Description

Anomaly Logs

An anomalous event has occurred. See Event log category triggers for an example.

Any Security Rating Notification

A summary is available for a recently run Security Rating report. The default report type is Any. Other available options include:

  • Security Posture
  • Fabric Coverage
  • Optimization

AV & IPS DB Update

The antivirus and IPS database is updating.

Compromised Host

An indicator of compromise (IoC) is detected on a host endpoint.

Additional actions are available only for Compromised Host triggers:

  • Access Layer Quarantine
  • FortiClient Quarantine
  • VMware NSX Security Tag
  • IP Ban

Configuration Change

A FortiGate configuration change has occurred.

Conserve Mode

A FortiGate entered conserve mode due to low memory. See Execute a CLI script based on memory and CPU thresholds for an example.

FortiGate Cloud-Based IOC

IOC detection from the FortiGate Cloud IOC service.

This option requires an IOC license, a web filter license, and FortiCloud logging must be enabled.

HA Failover

An HA failover is occurring.

High CPU

A FortiGate has high CPU usage. See Execute a CLI script based on memory and CPU thresholds for an example.

IPS Logs

An IPS event has occurred.

License Expiry

A FortiGuard license is expiring. The default license type is Any. Other available options include:

The license type must be selected. Options include:

  • FortiCare Support
  • FortiGuard Web Filter
  • FortiGuard AntiSpam
  • FortiGuard AntiVirus
  • FortiGuard IPS
  • FortiGuard Management Service
  • FortiGate Cloud

Local Certificate Expiry

A local certificate is about to expire. See Certificate expiration trigger for an example.

Reboot

A FortiGate is rebooting.

SSH Logs

An SSH event has occurred.

Traffic Violation

A traffic policy has been violated.

Virus Logs

A virus event has occurred.

Web Filter Violation

A web filter policy has been violated.

The following table outlines the available dynamic triggers.

Category

Trigger

Description

Security Fabric

Fabric Connector Event

An event has occurred on a specific Fabric connector. See Fabric connector event trigger for details.

FortiAnalyzer Event Handler

The specified FortiAnalyzer event handler has occurred. See FortiAnalyzer event handler trigger for details.

FortiGate Cloud Event Handler

The specified FortiGate Cloud event handler has occurred.

This option requires a FortiGate Cloud log retention license.

Miscellaneous

FortiOS Event Log

The specified FortiOS log has occurred.

Multiple event log IDs can be selected, and log field filters can be applied. See FortiOS event log trigger for an example.

Incoming Webhook

An incoming webhook is triggered.

Schedule

A scheduled monthly, weekly, daily, hourly, or one-time trigger. Set to occur on a specific minute of an specific hour on a specific day. When using the one-time trigger, set to occur on specific date and time in the future. See Schedule trigger for an example.